The platform suspended trading on Thursday, 29 October, while investigating the security incident. Its official status page marked the disruption resolved at 7.05pm GMT, following approximately one hour of restrictions on trading operations.
Polymarket said it had identified and fixed the problem affecting Polymarket. com and referred the matter to law enforcement in the United Kingdom. The company acknowledged that a third-party provider had been compromised but did not publicly identify the supplier in its initial statement.
“We’ll make this right and are fully reimbursing all affected traders,” the Polymarket Traders account announced after trading resumed. The company’s main account shared the announcement.
The extent of customer losses remained uncertain on Friday. Polymarket had not disclosed a verified total for stolen funds, the number of affected accounts or a timetable for completing reimbursements. Independent blockchain assessments suggested losses running into millions of dollars, although their estimates varied.
Blockchain analytics company Bubblemaps estimated that approximately 700 users lost around $2.7 million. Those figures have not been confirmed by Polymarket, and investigators have yet to establish a definitive account of the transactions attributed to the breach.
Customers had complained of missing balances and withdrawals they said they had not authorised. The allegations raised questions about whether attackers could exploit access to website components used by traders rather than directly compromise the platform’s underlying trading infrastructure.
The security incident has been linked to DebugBear, a United Kingdom-based provider of website performance monitoring services. DebugBear acknowledged that it was dealing with a security incident and advised customers using its Real User Monitoring product to remove embedded monitoring code from their websites.
The advisory concerned software that website operators install to observe how their pages perform for visitors. Such embedded scripts can run within a user’s browser, making the integrity of outside software suppliers particularly important for websites handling financial transactions.
Cybersecurity researchers examining the attack described malicious JavaScript associated with the monitoring service. Their preliminary analysis indicated that the code sought to identify active Polymarket sessions and initiate unauthorised activity involving customer assets.
That technical assessment does not establish that every affected wallet was compromised through precisely the same mechanism. Neither Polymarket nor DebugBear had published a comprehensive forensic account identifying the attacker’s entry point, the duration of exposure or all affected customers.
Polymarket’s status updates show that the exchange entered a restricted mode at 6.05pm GMT on Thursday. Users could cancel existing orders, but ordinary trading actions were suspended while the company investigated the disruption.
The platform subsequently announced that trading would restart at approximately 3pm Eastern time. Its status service recorded the incident as resolved five minutes later, with the trading interface and associated application programming services returning to operation.
The resumption of trading does not mean the investigation or compensation process has finished. Polymarket’s undertaking to make traders whole establishes a reimbursement commitment, but individual repayments and the final financial cost have not been independently established.
The incident affected Polymarket’s international cryptocurrency-based service, which allows participants to trade contracts linked to outcomes of political, sporting and other events. The company operates a separate United States platform, and no comparable disruption to that exchange was established by the international incident notice.
The breach follows a separate security episode in June involving a third-party supplier and the platform’s website interface. That episode also resulted in reported customer losses and a promise of reimbursement, although the two incidents have not been shown to involve the same attacker or vulnerability.
Polymarket’s October notice did not identify any flaw in the smart contracts supporting its prediction markets. The available findings instead focused on software delivered through a supplier and interactions occurring within users’ browser sessions.
The company’s published incident timeline also distinguished the interruption to its trading services from other platform functions. Account access and market data services were not listed as experiencing the same major outage, although individual customers reported problems involving their available funds and wallet balances.
DebugBear’s warning specifically addressed customers using its embedded Real User Monitoring code. It did not instruct every customer to stop using all of its services, and the company had not published a final technical assessment of the compromise.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
